Kazuma Matsumoto

**Name of the Vulnerable Software and Affected Versions** AI Chatbot & Workflow Automation by AIWU versions prior to 1.4.13 **Description** The plugin contains a missing authorization flaw resulting from the absence of capability checks and nonce verification on AJAX actions registered under `wp ajax ` and `wp ajax nopriv ` hooks. This occurs because the base controller's `getPermissions()` function returns an empty array and the `removeGroup` and `clear` methods are not included in `getNoncedMethods()`, causing the authorization gate to unconditionally allow these actions. Consequently, unauthenticated attackers can delete specific records by ID or wipe all records from any module's database table. **Recommendations** Update the plugin to a version later than 1.4.12. As a temporary mitigation, restrict access to the `removeGroup` and `clear` functions.

**Name of the Vulnerable Software and Affected Versions** AI Chatbot & Workflow Automation by AIWU versions prior to 1.4.13 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can exploit this by providing arbitrary scenario IDs to publish draft WordPress posts, exposing unpublished content, or unpublish live content, which may lead to service disruption. **Recommendations** Update AI Chatbot & Workflow Automation by AIWU to version 1.4.13 or later.

**Name of the Vulnerable Software and Affected Versions** SurfLink - Ultimate Link Manager versions prior to 2.6.1 **Description** Unauthorized data modification is possible due to a missing capability check and missing nonce verification in the `ajax import 410()` function. While other AJAX handlers in the same class implement proper authorization and nonce checks, this specific function allows authenticated attackers with Subscriber-level access and above to import arbitrary URLs into the 410 Gone database table via the `surfl import 410` AJAX action. This can lead to the site returning HTTP 410 Gone responses to visitors accessing those paths, potentially resulting in a denial of service for legitimate pages and SEO damage through search engine delisting. **Recommendations** Update to version 2.6.1 or later. As a temporary workaround, restrict access to the `ajax import 410()` function to prevent unauthorized imports.

**Name of the Vulnerable Software and Affected Versions** Genolve – AI image AI video generation plugin for WordPress versions prior to 5.0.6 **Description** Authenticated attackers with Contributor-level access and above can perform unauthorized modification of data. This is caused by a missing capability check in the `genolve setOpt()` function, allowing the update of arbitrary WordPress options. This can lead to privilege escalation by enabling user registration and setting the default role to administrator. **Recommendations** Update the plugin to version 5.0.6 or later. As a temporary mitigation, restrict access to the `genolve setOpt()` function for users with Contributor-level permissions.

**Name of the Vulnerable Software and Affected Versions** Pupsman versions prior to 3.9.0 **Description** An uncontrolled search path element issue allows for DLL hijacking. If a crafted DLL file is placed in the same folder as the affected installer and the installer is executed, arbitrary code may be executed with SYSTEM privilege. **Recommendations** Update Pupsman to version 3.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** Pupsman versions prior to 3.9.0 **Description** Incorrect default permissions allow an attacker to place a malicious executable within the installation folder. This can lead to arbitrary code execution with SYSTEM privilege, which is the highest level of administrative access on a Windows system. **Recommendations** Update Pupsman to version 3.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** Eclipse tinydtls versions prior to commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 **Description** An out-of-bounds read occurs in the `check server certificate()` function when processing a Certificate handshake message. Unauthenticated attackers can trigger reads beyond valid buffer boundaries by providing a specific `fragment length` value. This is possible due to missing buffer length validation before `uint24` reads, `memcmp`, and `memcpy` operations during DTLS epoch 0 on both client and server paths, which can lead to a denial of service on memory-constrained devices. **Recommendations** Update to the version containing commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221.

**Name of the Vulnerable Software and Affected Versions** Sonatype Nexus Repository (affected versions not specified) **Description** A remote unauthenticated attacker may be able to conduct credential-guessing attacks against user accounts via authentication endpoints. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AI Chatbot & Workflow Automation by AIWU versions prior to 1.4.15 **Description** The AI Chatbot & Workflow Automation by AIWU plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping involving the `X-Forwarded-For` header. Unauthenticated attackers can inject arbitrary web scripts into pages, which then execute when a user accesses the affected page. Practical exploitation is limited by a 20-character storage limit. **Recommendations** Update to a version later than 1.4.14.

**Name of the Vulnerable Software and Affected Versions** AI Chatbot & Workflow Automation by AIWU versions prior to 1.4.18 **Description** The AI Chatbot & Workflow Automation by AIWU plugin for WordPress contains a flaw allowing unauthenticated attackers to append additional SQL queries to existing ones. This is caused by insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query within the `getListForTbl()` function. This can lead to the extraction of sensitive information from the database. SQL Injection is a technique where an attacker inserts malicious SQL code into a query to manipulate the database. **Recommendations** Update to a version later than 1.4.17. As a temporary workaround, restrict access to the `getListForTbl()` function.

**Name of the Vulnerable Software and Affected Versions** FastBots versions prior to 1.0.13 **Description** The FastBots plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping in admin settings. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update to a version later than 1.0.12. As a temporary mitigation, restrict access to the admin settings or ensure `unfiltered html` is managed according to security best practices.

**Name of the Vulnerable Software and Affected Versions** Continually versions prior to 4.3.2 **Description** The Continually plugin for WordPress contains a Stored Cross-Site Scripting issue in the admin settings caused by insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update to a version later than 4.3.1.

**Name of the Vulnerable Software and Affected Versions** barebox versions prior to 2026.04.0 **Description** An out-of-bounds read occurs during DHCP option parsing within the `dhcp message type()` function because the software fails to verify that the options pointer remains within the received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet lacking a proper 0xff end marker, causing the parser to read past valid packet data and potentially crash the system. **Recommendations** Update to version 2026.04.0 or later. As a temporary workaround, restrict access to the network broadcast domain to minimize the risk of receiving crafted DHCP packets.

**Name of the Vulnerable Software and Affected Versions** barebox versions prior to 2026.04.0 **Description** A denial-of-service issue exists in the ext4 directory parsing within `fs/ext4/ext4 common.c`. The `ext4fs iterate dir()` function does not validate that directory entry length values are non-zero. An attacker can provide a malicious ext4 filesystem image containing a crafted directory entry with a `direntlen` value of 0, triggering an infinite loop during path resolution or directory listing, which causes the boot process to hang indefinitely. **Recommendations** Update to version 2026.04.0.

**Name of the Vulnerable Software and Affected Versions** barebox versions prior to 2026.04.0 **Description** An out-of-bounds read exists in the ext4 extent parsing process due to missing validation of the `eh entries` field against buffer capacity within the `fs/ext4/ext4 common.c` file. An attacker can trigger heap out-of-bounds reads during boot-time filesystem parsing by providing a malicious ext4 filesystem image via USB, SD card, or network boot, which may allow redirecting reads to arbitrary disk offsets. **Recommendations** Update to version 2026.04.0 or later.

**Name of the Vulnerable Software and Affected Versions** barebox versions prior to 2026.04.0 **Description** Multiple memory-safety issues exist in the EFI PE loader within the `efi/loader/pe.c` file. An integer overflow occurs during virtual image size computation when using 32-bit arithmetic on section `VirtualAddress` and size values, leading to undersized heap allocation. Additionally, the PE section loading logic does not validate if `PointerToRawData` plus the copied size stays within the PE file buffer. An attacker can provide a malicious EFI PE binary through TFTP, USB, SD card, or network boot to trigger a heap buffer overflow or an out-of-bounds read from heap memory, which could allow code execution in the bootloader context. **Recommendations** Update to version 2026.04.0.

**Name of the Vulnerable Software and Affected Versions** AVACAST (affected versions not specified) **Description** AVACAST contains an unquoted service path issue. This allows privileged local attackers to place a malicious executable file in a specific directory, leading to arbitrary code execution with system privileges when the AVACAST service starts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AVACAST (affected versions not specified) **Description** AVACAST contains a DLL Hijacking flaw that allows authenticated local attackers to place a malicious DLL in a specific directory. This can lead to arbitrary code execution with system privileges when the system loads the DLL. DLL Hijacking is a technique where an application is tricked into loading a malicious library instead of the intended one. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** LLMs.txt plugin for WordPress versions prior to 8.2.7 **Description** The plugin is subject to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in admin settings. Authenticated attackers with administrator-level permissions or higher can inject arbitrary web scripts into pages. These scripts execute when a user accesses the affected page. This issue specifically impacts multi-site installations and environments where `unfiltered html` has been disabled. **Recommendations** Update the plugin to a version later than 8.2.6.

**Name of the Vulnerable Software and Affected Versions** LLMs.txt plugin for WordPress versions prior to 8.2.7 **Description** Reflected Cross-Site Scripting is possible via the 'tab' parameter. The issue arises from the use of filter input() without a sanitization filter and insufficient output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages that execute if an administrator is tricked into clicking a link. **Recommendations** Update the plugin to a version later than 8.2.6. Avoid using the `tab` parameter in the affected plugin until the update is applied.